Iranian crypto exchanges saw a sharp burst of on-chain activity in the hours following joint US-Israeli airstrikes on February 28, with roughly $10.3 million in cryptoasset outflows recorded between February 28 and March 2, according to a new report from blockchain analytics firm Chainalysis.
Hourly outflows from major Iranian platforms climbed sharply once news of the strikes broke, approaching or exceeding $2 million within several hours, well above typical volumes for that time frame, according to the report.
In January, Chainalysis reported that total crypto activity tied to Iran reached $7.8 billion in 2025, driven by a “collapsing rial, inflation running at historic highs, and sanctions” that have severed the country from conventional dollar-denominated financial infrastructure.
That report documented how on-chain activity has consistently surged around major shocks, from the Kerman bombings in early 2024 to direct military exchanges between Iran and Israel across 2024 and 2025.
The authors of the latest report wrote that in the immediate aftermath of the weekend’s strikes, it is “too early to say how much of the activity” reflects ordinary Iranians moving into self-custody, exchanges reshuffling liquidity, or state-aligned actors repositioning funds.
Meanwhile, Iran’s central bank quietly accumulated $507 million in Tether’s USDT stablecoin over the past year, according to blockchain intelligence firm Elliptic, routing most of it through Nobitex, Iran’s largest exchange, to inject dollar liquidity into the domestic market and prop up the rial.
TRM Labs also found that two UK-registered crypto exchanges, Zedcex and Zedxion, moved $619.1 million on behalf of the IRGC in 2024 alone, accounting for 87% of both firms’ total transaction volume that year.
Outflow explanations
Chainalysis identifies three plausible explanations for what the post-airstrike data could reflect, none of which is mutually exclusive.
The first is ordinary Iranians pulling funds off centralized exchanges into self-custody, the same behavior documented during the protest wave.
The second one is Iranian exchanges cycling funds into newly created wallets to reduce their blockchain visibility, a routine tactic under sanctions pressure that intensified after pro-Israel hackers drained Nobitex of more than $90 million.
Chainalysis noted that “in times of intense political pressure,” Iranian exchanges are “particularly motivated to move sizable amounts of liquidity off easily identifiable addresses.”
The third is state-linked actors, including IRGC-affiliated entities, using domestic exchange rails to move funds tied to sanctions evasion or cross-border trade, a channel multiple blockchain intelligence firms have flagged as active and growing.
Several factors complicate any immediate reading of the data, Chainalysis said, citing past internet blackouts that muted retail access even as on-chain activity shifted.
Apparent withdrawals may also end at exchange- or state-controlled wallets, while cyber and seizure risks drive liquidity reshuffling; though Nobitex has been largely inaccessible since the strikes, blockchain flows suggest some domestic access remains.
Onward fund movements, Chainalysis added, will ultimately “sharpen the picture.”
Iran’s Ministry of Defence Export Center, Mindex, began accepting crypto as payment for weapons sales in early 2026, with Andrew Fierman, the Head of National Security Intelligence at Chainalysis, previously telling Decrypt that crypto functions as an “alternative payment rail to facilitate cross-border trade” in the face of sanctions.
On prediction market Myriad, owned by Decrypt’s parent company Dastan, users place a 60% chance on the Iranian regime remaining in place through October—and are almost evenly split on the likelihood of a ceasefire before April.
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.
